Download the PHP package elsnertechnologies/laravel-health-monitor without Composer

Laravel Health Monitor

Check the health of any PHP/Laravel package before you install it.

One artisan command gives you a 0–100 health score built from live Packagist + GitHub data, a Laravel compatibility answer, smart alternative suggestions, JSON output for CI/CD pipelines — and an optional AI verdict.

Features

• 🩺 0–100 health score — weighted across 5 dimensions: Maintenance, Community, Usage, Stability, Security
• 📡 Live data from Packagist + GitHub — downloads, stars, releases, issues, security advisories, abandoned flags
• 🖥 Laravel version compatibility check — "will it work on Laravel X?" with the exact older version to install when the latest doesn't
• 💡 Smart alternatives — similar packages ranked by usage
• 🤖 Optional AI verdict — a short Claude-written recommendation (bring your own Anthropic API key; everything else works without one)
• ⚙️ JSON output + --min-score gate — drop it straight into CI/CD pipelines
• 🌐 Web dashboard — visit /laravel-health-monitor in your app to check any package in the browser and audit everything already installed in your project
• 🛡 Full project audit — one click checks every installed package for known CVEs and abandonment, health-scores your direct requirements, and scans your application code for malware indicators (webshells, obfuscated eval chains, PHP dropped in storage/uploads) plus hygiene problems (debug mode in production, exposed .env/.git)
• 🚀 Simple installation — one composer require, zero configuration required

Perfect for

• Laravel developers deciding between packages
• Development teams enforcing package quality standards
• DevOps pipelines gating dependencies in CI
• Production applications auditing what they already depend on

Requirements

• PHP 7.2.5+
• Laravel 7, 8, 9, 10, 11, 12 or 13
• No API key needed (AI verdict is the only optional key-gated feature)

Installation

The service provider is auto-discovered. Optionally publish the config:

Usage

Web dashboard

Once the package is installed, open:

You get a browser dashboard that:

• Checks any package on Packagist — type any vendor/package (not just Laravel packages), pick a Laravel version, and get the full health report: score badge, 5 dimension bars, live metrics, compatibility answer, security advisories, alternatives and sources.
• Lists every package installed in your project — read from your app's composer.lock, with direct/dev requirements flagged and a one-click "Check health" link per package.
• Runs a full project audit — packages, code and hygiene in one report (see below).
• Serves JSON too — append &format=json to /laravel-health-monitor/check?package=vendor/package for machine-readable output.

Click Check health on any package (installed or not) for the full report:

Configure it in config/health-monitor.php:

Tip: in production, either disable the dashboard (HEALTH_MONITOR_WEB_ENABLED=false) or add auth middleware — the page reveals your dependency list and audit results.

The views are publishable if you want to restyle them:

Full project audit (packages + code + malware scan)

Click Run project audit on the dashboard (or open /laravel-health-monitor/audit) and the package audits your whole application in four steps:

1. All installed packages checked for known vulnerabilities — every entry in your composer.lock is checked against the Packagist security-advisory database (batched, one HTTP request per 50 packages) and for abandoned flags.
2. Direct requirements health-scored — each package you explicitly require gets the full 0–100 health analysis, listed worst-first so you see what needs attention. Capped by health-monitor.audit.max_health_checks (default 25) to respect GitHub's 60 req/hour unauthenticated limit — set HEALTH_MONITOR_GITHUB_TOKEN to raise it.
3. Code scan for malware indicators — your app/, config/, routes/, public/, storage/app … directories are scanned for:
   • obfuscated eval(base64_decode(...)) / gzinflate / str_rot13 payload chains
   • eval(), assert(), system(), exec() fed by $_GET/$_POST/$_REQUEST input (backdoors/webshells)
   • request input used as a function name, include/require from request input or remote URLs
   • unserialize()/extract() of request input, preg_replace /e, create_function()
   • known webshell filenames (c99, r57, b374k, wso, …), PHP files with double extensions (avatar.jpg.php), PHP dropped in storage/ or the public web root
   • heavy hex obfuscation and suspicious base64 blobs
4. Project hygiene — APP_DEBUG on outside local, missing APP_KEY, .env or .git exposed in the public web root, missing composer.lock.

Everything is condensed into one 0–100 project score. JSON output for CI: /laravel-health-monitor/audit?format=json; force live data with ?fresh=1.

Tune the scan in config/health-monitor.php:

Note: the code scan is a heuristic indicator scanner, not an antivirus. Findings are leads to review — and a clean result is not a guarantee. If you suspect a real compromise, rotate credentials and redeploy from a known-good source.

JSON output (CI/CD)

--json prints a single JSON document; the exit code is 0 on success and 1 when the package is missing or below --min-score:

GitHub Actions example:

Configuration

All settings are environment-driven — publishing the config file is optional.

Step-by-step: using the plugin day to day

Step 1 — Before installing any new package

Read the three key lines first:

1. The score badge (98/100 Active / Safe) — your instant go/no-go signal.
2. The compatibility answer (✔ YES / ✘ NO → Install vendor/package:x.y.z instead) — tells you the exact version to require.
3. The recommendation line — a plain-language summary of the verdict.

If all three look good, install it. If compatibility says NO, use the suggested version:

Step 2 — When comparing two packages for the same job

Run the check on both, then compare dimension by dimension:

Also look at the 💡 Alternatives section of each report — it may surface a third option you didn't know about, ranked by real download numbers.

Step 3 — Auditing what you already depend on

Check the direct dependencies from your composer.json:

Anything scoring below 60, abandoned, or carrying security advisories goes on your migration list.

Step 4 — Enforcing quality in CI

Gate new dependencies in your pipeline so low-quality packages never reach main:

Exit code 0 = pass, 1 = below the bar (or package not found) — the build fails automatically.

Step 5 — When you want a second opinion

With an Anthropic API key configured, Claude reads all collected metrics and writes a short verdict naming the strongest signal in favor and the biggest risk.

How to read the scores

The overall score

Diagnosing a low score, dimension by dimension

The bars tell you why a score is low. Each dimension points at a different real-world problem:

Typical patterns:

• High usage + low maintenance → a once-popular package going stale (e.g. fzaninotto/faker). Migrate before it blocks a Laravel upgrade.
• High maintenance + low usage/community → young but active package. Fine for non-critical features; pin the minor version.
• Security below 100 → scroll to 🛡 Security advisories. Advisories on old versions are normal for mature packages — verify the version you would install is not in the affected range.

Reading the compatibility answer

Exit codes (for scripts and CI)

How the score works

Each dimension is scored 0–100 from live data, then combined with these weights:

• 80–100 → Active / Safe
• 60–79 → Aging / Caution
• 0–59 → Risky / Avoid

Thresholds and weights live in config/health-monitor.php.

Testing

License

MIT — see LICENSE.